CYBER AND PRIVACY INSURANCE

Transcription

1 ACE PRIVACY PROTECTION CYBER AND PRIVACY INSURANCE APPLICATION FORM NOTICE The policy for which you are applying is written on a claims made and reported basis. Only claims first made against the insured and reported to the insurer during the policy period or extended reporting period, if applicable, are covered subject to the policy provisions. The limits of liability stated in the policy are reduced, and may be exhausted, by claims expenses. Claims expenses are also applied against your retention, if any. If a policy is issued, the application is attached to and made a part of the policy so it is necessary that all questions be answered in detail. INSTRUCTIONS Please respond to answers clearly. Underwriters will rely on all statements made in this application. This form must be dated and signed by the CEO, CFO, President, Risk Manager or General Counsel. Completion of this submission may require input from your organization s risk management, information technology, finance, and legal departments: Please note that you may be asked to provide the following information as part of the underwriting process: Security Supplemental Application based on certain revenue or record counts (over $500mm in annual revenues or over 2mm Privacy Information records) Most recent annual report, 10K or audited financials List of all material litigation threatened or pending (detailing plaintiff s name, cause(s) of action/allegations, and potential damages) which could potentially affect the coverage for which applicant is applying Descriptions of any acts, errors or omissions which might give rise to a claim(s) under the proposed policy Loss runs for the last five years Copy of your in-house corporate privacy policy(ies) currently in use by your organization NEED HELP If you have any questions about the items asked in this form, please contact your broker or agent. An ACE underwriter can also be made available to discuss the application. ACE Cyber and Privacy Insurance, Application Form, Page 1 of 10 Published 05/2015

2 Part 1 Company Information Company Name Address (City, State, Zip) Applicant Name Address Title Phone Company Type Primary Industry Years Established Number of Employees Last 12 months gross revenues (% online if applicable) Primary Company Website(s) Projected 12 months gross revenue (% online if applicable) Operates outside of the United States Part 2 Information Privacy and Governance. Which of the following types of Privacy Information (Personal Information or Third Party Corporate Information) does your company store, process, transmit or is otherwise responsible for securing? Please indicate total number of records (if known) inclusive of both internal staff or 3 rd parties: a. Government issued identification numbers (e.g., social security numbers) b. Credit card numbers, debit card numbers or other financial account numbers c. Healthcare or medical records d. Intellectual property (e.g., third party intellectual property trade secrets, M&A info) e. Usernames and passwords f. Does the company maintain a data classification and data governance policy? g. Does the company maintain documentation that clearly identifies the storage and transmission of all Privacy Information? h. When was the company s privacy policy last reviewed? i. (Optional) Additional comments regarding the Information Privacy and Governance: ACE Cyber and Privacy Insurance, Application Form, Page 2 of 10

3 Which are the following statements are valid as it relates to Privacy Information Governance. Use the comments for clarification as needed. j. Does your company encrypt Privacy Information when: 1. Transmitted over public networks (e.g., the Internet) 2. Stored on mobile assets (e.g., laptops, phones, tablets, flash drives) 3. Stored on enterprise assets (e.g., databases, file shares, backups) 4. Stored with 3 rd party services (e.g., cloud) k. Does your company store Privacy Information on a secure network zone that is segmented from internal network l. (Optional) What other technologies are used to secure Privacy Information (e.g., tokenization)? m. (Optional) Additional comments regarding the Privacy Information Governance: Part 3 - Security Organization a. Does your company have an individual designated for overseeing information security? b. Does your company have an individual designated for overseeing information privacy? c. Is your company compliant with any of the following regulatory or compliance frameworks (please check all that apply and indicate most recent date of compliance): ISO17999 SOX PCI-DSS HITECH HIPAA GLBA SSAE-16 FISMA Other d. Does your company leverage any industry security frameworks for confidentiality, integrity and availability (e.g., NIST, COBIT)? e. Is your company an active member in outside security or privacy groups (e.g., ISAC, IAPP, ISACA)? f. (Optional) What percentage of the overall IT budget is allocated for security? g. (Optional) Additional comments regarding the Information Security Organization: ACE Cyber and Privacy Insurance, Application Form, Page 3 of 10

4 Part 4 - Information Security. Use the comments field for clarification as needed. a. Does the company have a formal risk assessment process that identifies critical assets, threats and vulnerabilities? b. Does the company have a disaster recovery and business continuity plan? c. Does the company have an Incident Response Plan for determining the severity of a potential data security breaches and providing prompt notification to all individuals who may be adversely affected by such exposures? d. Does the company have an intrusion detection solution that detects and alerts an individual or group responsible for reviewing malicious activity on the company network? e. Does the company configure firewalls to restrict inbound and outbound network traffic to prevent unauthorized access to internal networks? f. Does the company perform reviews at least annually of the company s third-party service providers to ensure they adhere to company requirements for data protection? g. Does the company use multi-factor authentication for remote network access originating from outside the company network by employees and third parties (e.g., VPN, remote desktop)? h. Does the company conduct security vulnerability assessments to identify and remediate critical security vulnerabilities on the internal network and company public websites on the Internet? i. Does the company install and update an anti-malware solution on all systems commonly affected by malicious software (particularly personal computers and servers)? j. Does the company use any software or hardware that has been officially retired (i.e., considered endof-life ) by the manufacturer (e.g., Windows XP)? k. Does the company update (e.g., patch, upgrade) commercial software for known security vulnerabilities per the manufacturer advice? l. Does the company update open source software (e.g., Java, Linux, PHP, Python, OpenSSL) that is not commercially supported for known security vulnerabilities? m. Does the company have processes established that ensure the proper addition, deletion and modification of user accounts and associated access rights? n. Does the company enforce passwords that are at least seven characters and contain both numeric and alphabetic characters? o. Does the company require annual security awareness training for all personnel so they are aware of their responsibilities for protecting company information and systems? p. Does the company screen potential personnel prior to hire (e.g., background checks include previous employment history, drug, criminal record, credit history and reference checks)? q. Does the company have a solution to protect mobile devices (e.g., Laptops, iphones, ipads, Android, Tablets) to prevent unauthorized access in the event the device is lost or stolen? r. Does the company have entry controls that limit and monitor physical access to company facilities (e.g., offices, data centers, etc.)? ACE Cyber and Privacy Insurance, Application Form, Page 4 of 10

5 Part 5 Third Party Technology Services (e.g., cloud, web hosting, co-location, managed services) a. Is there an individual responsible for the security of the company information that resides at third party technology service providers? b. Do your third party technology service providers meet required regulatory requirements that are required by your company (e.g., PCI-DSS, HIPAA, SOX, etc.)? c. Does your company perform assessments or audits to ensure third party technology providers meet company security requirements? If Yes, when was the last audit completed? d. Does your company have a formal process for reviewing and approving contracts with third party technology service providers? e. (Optional) Additional comments regarding the Third Party Technology Services: Part 6 - Current Network & Technology Providers (if applicable and required at time of binding) Internet Communication Services Credit Card Processor(s) Website Hosting Other Providers (e.g., Human Resource, Point of Sale) Collocation Services Anti-virus Software Managed Security Services Firewall Technology Broadband ASP Services Intrusion Detection Software Outsourcing Services Cloud Services (e.g., Amazon, Salesforce, Office365) Please complete the following information for cloud services you process or store Privacy Information. Use the optional comments if more space is required: Cloud Provider Type Service # of Records Encrypted Storage (Optional) Additional comments regarding cloud services: ACE Cyber and Privacy Insurance, Application Form, Page 5 of 10

6 Part 7 Internet Media Information (only required if Internet Media Coverage is being requested) a. Please list the domain names for which coverage is requested: b. Has legal counsel screened the use of all trademarks and service marks, including your use of domain names and metatags, to ensure they do not infringe on the intellectual property of others? c. Do you obtain written permissions or releases from third party content providers and contributors, including freelancers, independent contractors, and other talent? d. Do you require indemnification or hold harmless agreements from third parties (including outside advertising or marketing agencies) when you contract with them to create or manage content on your behalf? e. If you sell advertising space on any of your websites, are providers of advertisements required to execute indemnification and hold harmless agreements in your favor? f. Have your privacy policy, terms of use, terms of service, and other customer policies been reviewed by counsel? g. Do you involve legal counsel in reviewing content prior to publication or in evaluating whether it should be removed when notified that content is defamatory, infringing, in violation of a third party s privacy rights, or otherwise improper? h. Does your website include content directed at children under the age of 18? i. Do you collect data about children who use your website? Do you obtain parental consent regarding your collection of data about children who use your website? n/a j. Please describe your company s process to review content prior to publication to avoid the posting, publishing or dissemination of content that is defamatory, infringing, in violation of a third party s privacy rights or otherwise: k. Please describe your review and takedown procedure when notified that content is defamatory, infringing, in violation of a third party s privacy rights or otherwise improper: l. (Optional) Additional comments regarding the Internet Media Information: ACE Cyber and Privacy Insurance, Application Form, Page 6 of 10

7 Part 8 - Current Loss Information. In the past 5 years has the company ever experienced any of the following events or incidents? Please check all that apply. Please use the comments below to describe any current losses. a. Company was declined for Privacy, Cyber, Network, or similar insurance, or had an existing policy cancelled (Missouri applicants do not answer this question) b. Company, its directors, officers, employees or any other person or entity proposed for insurance has knowledge of any act, error or omission which might give rise to a claim(s) under the proposed policy c. Company has been the subject of an investigation or action by any regulatory or administrative agency for violations arising out of your advertising or sales activities d. Company sustained a loss of revenue due to a systems intrusion, denial-of-service, tampering, malicious code attack or other type of cyber attack e. Company had portable media (e.g., laptop, backup tapes) that was lost or stolen and was not encrypted f. Company had to notify customers or offer credit monitoring that their personal information was or may have been compromised as a result of the your activities g. Company received a complaint concerning the content of the company website or other online services related to intellectual property infringement, content offenses, or advertising offenses h. Company sustained an unscheduled network outage that lasted over 24 hours (Optional) Additional comments regarding Current Loss Information: Part 9: Current Coverage. Which of the following policies does the company currently have in force: General Liability Policy D&O Policy Professional Liability Cyber / Privacy Liability Policy Other Related Policy (not listed) Crime (Optional) Additional comments regarding Current Coverage: ACE Cyber and Privacy Insurance, Application Form, Page 7 of 10

8 FRAUD WARNING STATEMENTS NOTICE TO ALABAMA APPLICANTS: Any person who knowingly presents a false or fraudulent claim for payment of a loss or benefit or who knowingly presents false information in an application for insurance is guilty of a crime and may be subject to restitution fines or confinement in prison, or any combination thereof. NOTICE TO ARKANSAS, LOUISIANA, RHODE ISLAND AND WEST VIRGINIA APPLICANTS: Any person who knowingly presents a false or fraudulent claim for payment of a loss or benefit or knowingly presents false information in an application for insurance is guilty of a crime and may be subject to fines and confinement in prison. NOTICE TO COLORADO APPLICANTS: It is unlawful to knowingly provide false, incomplete, or misleading facts or information to an insurance company for the purpose of defrauding or attempting to defraud the company. Penalties may include imprisonment, fines, denial of insurance, and civil damages. Any insurance company or agent of an insurance company who knowingly provides false, incomplete, or misleading facts or information to a policyholder or claimant for the purpose of defrauding or attempting to defraud the policyholder or claimant with regard to a settlement or award payable from insurance proceeds shall be reported to the Colorado Division of Insurance within the Department of Regulatory Agencies. NOTICE TO DISTRICT OF COLUMBIA APPLICANTS: WARNING: It is a crime to provide false or misleading information to an insurer for the purpose of defrauding the insurer or any other person. Penalties include imprisonment and/or fines. In addition, an insurer may deny insurance benefits, if false information materially related to a claim was provided by the applicant. NOTICE TO FLORIDA APPLICANTS: Any person who knowingly and with intent to injure, defraud, or deceive any insurer files a statement of claim or an application containing any false, incomplete or misleading information is guilty of a felony of the third degree. NOTICE TO KANSAS APPLICANTS: Any person who, knowingly and with intent to defraud, presents, causes to be presented or prepares with knowledge or belief that it will be presented to or by an insurer, purported insurer, broker or any agent thereof, any written statement as part of, or in support of, an application for the issuance of, or the rating of an insurance policy for personal or commercial insurance, or a claim for payment or other benefit pursuant to an insurance policy for commercial or personal insurance which such person knows to contain materially false information concerning any fact material thereto; or conceals, for the purpose of misleading, information concerning any fact material thereto commits a fraudulent insurance act. NOTICE TO KENTUCKY APPLICANTS: Any person who knowingly and with intent to defraud any insurance company or other person files an application for insurance containing any materially false information or conceals, for the purpose of misleading, information concerning any fact material thereto commits a fraudulent insurance act, which is a crime. NOTICE TO MAINE APPLICANTS: It is a crime to knowingly provide false, incomplete or misleading information to an insurance company for the purpose of defrauding the company. Penalties may include imprisonment, fines or a denial of insurance benefits. NOTICE TO MARYLAND APPLICANTS: Any person who knowingly or willfully presents a false or fraudulent claim for payment of a loss or benefit or who knowingly or willfully presents false information in an application for insurance is guilty of a crime and may be subject to fines and confinement in prison. NOTICE TO MINNESOTA APPLICANTS: A person who submits an application or files a claim with intent to defraud or helps commit a fraud against an insurer is guilty of a crime. NOTICE TO NEW JERSEY APPLICANTS: Any person who includes any false or misleading information on an application for an insurance policy is subject to criminal and civil penalties. NOTICE TO NEW MEXICO APPLICANTS: Any person who knowingly presents a false or fraudulent claim for payment of a loss or benefit or knowingly presents false information in an application for insurance is guilty of a crime and may be subject to civil fines and criminal penalties. NOTICE TO NEW YORK APPLICANTS: Any person who knowingly and with intent to defraud any insurance company or other person files an application for insurance or statement of claim containing any materially false information, or conceals for the purpose of misleading, information concerning any fact material thereto, commits a fraudulent insurance act, which is a crime, and shall also be subject to a civil penalty not to exceed five thousand dollars and the stated value of the claim for each such violation. NOTICE TO OHIO APPLICANTS: Any person who, with intent to defraud or knowing that he/she is facilitating a fraud against an insurer, submits an application or files a claim containing a false or deceptive statement is guilty of insurance fraud. NOTICE TO OKLAHOMA APPLICANTS: WARNING: Any person who knowingly, and with intent to injure, defraud or deceive any insurer, makes any claim for the proceeds of an insurance policy containing any false, incomplete or misleading information is guilty of a felony. NOTICE TO OREGON APPLICANTS: Any person who knowingly and with intent to defraud any insurance company or another person files an application for insurance or statement of claim containing any materially false information, or conceals for the purpose of misleading information concerning any fact material thereto, may be committing a fraudulent insurance act, which may be a crime and may subject the person to criminal and civil penalties. ACE Cyber and Privacy Insurance, Application Form, Page 8 of 10

9 NOTICE TO PENNSYLVANIA APPLICANTS: Any person who knowingly and with intent to defraud any insurance company or other person files an application for insurance or statement of claim containing any materially false information or conceals for the purpose of misleading, information concerning any fact material thereto, commits a fraudulent insurance act, which is a crime and subjects such person to criminal and civil penalties. NOTICE TO VERMONT APPLICANTS: Any person who knowingly presents a false statement in an application for insurance may be guilty of a criminal offense and subject to penalties under state law. or misleading information to an insurance company for the purpose of defrauding the company. Penalties include imprisonment, fines and denial of insurance benefits. NOTICE TO ALL OTHER APPLICANTS: Any person who knowingly and with intent to defraud any insurance company or another person, files an application for insurance or statement of claim containing any materially false information, or conceals information for the purpose of misleading, commits a fraudulent insurance act, which is a crime and may subject such person to criminal and civil penalties NOTICE TO TENNESSEE, VIRGINIA AND WASHINGTON APPLICANTS: It is a crime to knowingly provide false, incomplete DECLARATION AND CERTIFICATION FOR ALL APPLICANTS IN ALASKA, ALABAMA, ARIZONA, DELAWARE, FLORIDA, GEORGIA, HAWAII, IDAHO, KANSAS, KENTUCKY, MAINE, MONTANA, NORTH CAROLINA, NEW HAMPSHIRE, NEVADA, OKLAHOMA, OREGON, PENNYSYLVANIA, SOUTH DAKOTA, VIRGINIA, WEST VIRGINIA, AND WYOMING: By signing this application, the applicant represents to the company that all statements made in this application and attachments hereto about the applicant and its operations are true and complete, and that no material facts have been misstated or misrepresented in this application, suppressed or concealed. The undersigned agrees that if after the date of this application and prior to the effective date of any policy based on this application, any occurrence, event or other circumstance should render any of the information contained in this application inaccurate or incomplete, then the undersigned shall notify the company of such occurrence, event or circumstance and shall provide the company with information that would complete, update or correct such information. Any outstanding quotations may be modified or withdrawn at the sole discretion of the company. Completion of this form does not bind coverage. The applicant s acceptance of the company s quotation is required before the applicant may be bound and a policy issued. The applicant agrees that this application, if the insurance coverage applied for is written, shall be the basis of the contract with the insurance company, and be deemed to be a part of the policy to be issued as if physically attached thereto. The applicant hereby authorizes the release of claims information from any prior insurers to the company. FOR ALL APPLICANTS IN ARKANSAS, CALIFORNIA, COLORADO, CONNECTICUT, DISTRICT OF COLUMBIA, ILLINOIS, INDIANA, IOWA, LOUISIANA, MARYLAND, MASSACHUSETTS, MICHIGAN, MINNESOTA, MISSISSIPPI, MISSOURI, NEBRASKA, NEW JERSEY, NEW MEXICO, NEW YORK, NORTH DAKOTA, OHIO, RHODE ISLAND, SOUTH CAROLINA, TENNESSEE, TEXAS, UTAH, VERMONT, WASHINGTON, AND WISCONSIN: By signing this application, the applicant warrants to the company that all statements made in this application and attachments hereto about the applicant and its operations are true and complete, and that no material facts have been misstated or misrepresented in this application, suppressed or concealed. The undersigned agrees that if after the date of this application and prior to the effective date of any policy based on this application, any occurrence, event or other circumstance should render any of the information contained in this application inaccurate or incomplete, then the undersigned shall notify the company of such occurrence, event or circumstance and shall provide the company with information that would complete, update or correct such information. Any outstanding quotations may be modified or withdrawn at the sole discretion of the company. Completion of this form does not bind coverage. The applicant s acceptance of the company s quotation is required before the applicant may be bound and a policy issued. The applicant agrees that this application, if the insurance coverage applied for is written, shall be the basis of the contract with the insurance company, and be deemed to be a part of the policy to be issued as if physically attached thereto. The applicant hereby authorizes the release of claims information from any prior insurers to the company. ACE Cyber and Privacy Insurance, Application Form, Page 9 of 10

10 SIGNATURE FOR ALL APPLICANTS (REQUIRED) Signed: Print Name & Title: Date (MM/DD/YY): /Phone: (must be Officer of Applicant) SIGNATURE - FOR ARKANSAS, MISSOURI, AND WYOMING APPLICANTS ONLY PLEASE ACKNOWLEDGE AND SIGN THE FOLLOWING DISCLOSURE TO YOUR APPLICATION FOR INSURANCE: I understand and acknowledge that the policy for which i am applying contains a defense within limits provision which means that claims expenses will reduce my limits of liability and may exhaust them completely. Should that occur, I shall be liable for any further claims expenses and damages. Applicant s Signature (Arkansas, Missouri, & Wyoming Applicants, In Addition To Application Signature Above): Signed: Print Name & Title: Date (MM/DD/YY): /Phone: (must be Officer of Applicant) FOR FLORIDA APPLICANTS ONLY: Agent Name: Agent License ID Number: FOR IOWA APPLICANTS ONLY: Broker: Address: ACE Cyber and Privacy Insurance, Application Form, Page 10 of 10 Published 05/2015